Will It Vibe?File include/require path built from request input
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
include/require (or their _once variants) resolve a path that is built from $_GET/$_POST/$_REQUEST/$_COOKIE. Depending on include_path and the PHP configuration, this can let a request pull in and execute an arbitrary local (or, with wrappers enabled, remote) file.
Why it matters
When the path passed to include or require is built from request data, the request effectively picks which file the server executes. Depending on PHP's configuration this ranges from reading arbitrary local files (leaking source and secrets) to, with a URL-capable stream wrapper enabled, executing remote attacker-supplied code.
How to fix it
Never build an include path from request input. Take a short identifier from the request and look it up in a fixed allowlist array that maps to the real file paths, rejecting anything not present in the map. If the set of includable views is static, a switch statement or a route table is safer than any path arithmetic.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo